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(TS//SI//REL) Using a combination of national assets and techniques developed under the 
GHOSTHUNTER project, Menwith Hill Station has achieved success in locating Internet cafes 
commonly used by High Value Targets (HVTs) in Iraq. Most notably, MHS has managed to locate 
terminals used by associates of Abu Ayyub Al-Misri, the successor to Al-Zarqawi as the number 
one Al-Qa'ida leader in Iraq. 

(TS//SI//REL) The GHOSTHUNTER system was designed to provide location information about 
VSATs i to support SIGINT-enabled surveillance and other operations. Terminals from the 
current top three VSAT technologies in the Middle East -- DirecWay, Linkstar, and iDirect — have 
all been successfully located as part of the GHOSTHUNTER initiative 2 . 

(TS//SI//REL) Terminals Associated with Al-Misri Group Are Traced to Ramadi 

(TS//SI//REL) In early August 2006, MHS developed a quick reaction capability to derive 
locations for specific iDirect VSATs of interest to the Network Analysis Center (NAC) at NSA-W. 
The target terminals serviced three Internet cafes in Iraq and were directly linked to Al-Misri 
associates. Within five days, Menwith Hill confirmed the three terminals were located in Ramadi. 

(U) Precise Locations Are Determined 

(TS//SI//REL) In early November 2006, the New Mission Development Center (NMDC) at MHS 
received multiple HVT tips to locate iDirect VSAT terminals, including some associated w ith al- 
Misri's immediate couriers. Developmental Analysts and engineers at MHS, and 

Field Station Denver successfully resolved the location of the Internet cafes of interest. Imagery 
support further enhanced this information by providing high-resolution images that enabled 
tactical assets to identify the exact l ocation of th e iDirect VSAT terminal. This identified terminal 
provides service to the high priority wireless network being targeted by the NAC. 


(S//REL) Other GHOSTHUNTER Successes 

(TS//SI//REL) To date, the GHOSTHUNTER capabilities at MHS have supported more than a 
dozen HVT searches targeting both Linkstar and iDirect VSAT communications. Additionally, 
GHOSTHUNTER operates daily in survey mode mapping out networks of interest by providing 
location data of VSAT terminals identified in the traffic. Approximately 150 VSAT terminals on 
networks of interest have been located to Baghdad, Ramadi, and neighboring cities during the 
past two months. Location details and associated knowledge derived through GHOSTHUNTER 
processing is being sent to and maintained in MASTERSHAKE 3 , the NAC's DNI 4 location 
database. 

(U) Looking Ahead 

(TS//SI//REL) GHOSTHUNTER, the only capability of its kind, has captured the interest of many 
across the Intelligence Community. Menwith Hill Station, in concert with multiple organizations, 
continues to develop this capability for integration into future baseline system deployments. 
Achievements obtained through this effort reflect the benefits of cross-access integration, 
teamwork and inter-agency collaboration to enable tactical operations. 


(U) Notes: 

i (U) VSAT = Very Small Aperture Terminal 









2 (S//SI//REL) Details about commonly used VSAT technologies were provided by the Network 
Analysis Center. 

3 (TS//SI//REL) For background on MASTERSHAKE, see the article MASTERSHAKE: Locating 
Terrorists at Internet Cafes 

4 (U) DNI = Digital Network Intelligence 


"(U//FOUO) SIDtoday articles may not be republished or reposted outside NSANet 
without the consent of S0121 (DL sid comms) ." 


DYNAMIC PAGE - HIGHEST POSSIBLE CLASSIFICATION IS 
TOP SECRET // SI / TK // REL TO USA AUS CAN GBR NZL 
DERIVED FROM: NSA/CSSM 1-52, DATED 08 JAN 2007 DECLASSIFY ON: 20320108 






